dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3

Analysis

max time kernel
135s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:53

Target

dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe
Size

83KB
MD5

8490bb5a03e4189cfaf34bed7dde83f8
SHA1

065060792c692a74c45d56927de9e394e739c8f4
SHA256

dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3
SHA512

c67b53beb61cf25e0fcf4244616a8dc73961afb61cf8151b655fd75a1c348d6403e63e2450557b5cfaf2f17262f264deeeff32b9382e5017db5d055b412df941
SSDEEP

1536:nUXJ8H5w6+EGFX0w+zCFTXj6mHNpXHNObIdCBWaZgGTufRdPLYNf+XAvG2DLcmAs:nU58Ha6pGFqzCNHNpXNgtET3dzwmMDgs

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

2004 dw20.exe

pid	process
2004	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe

description	pid	process	target process
PID 1724 wrote to memory of 2004	1724	dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe	dw20.exe
PID 1724 wrote to memory of 2004	1724	dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe	dw20.exe
PID 1724 wrote to memory of 2004	1724	dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe	dw20.exe
PID 1724 wrote to memory of 2004	1724	dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe
"C:\Users\Admin\AppData\Local\Temp\dffe97932090808a255eeab9fe320f52d9bce3b53eb83f55b26d671e799c72c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 412
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2004

memory/1724-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1724-58-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/2004-55-0x0000000000000000-mapping.dmp

Download